feat: add PipeWire socket mount support for sandbox

[dengbo11]

1. Added enable-pipewire flag to CLI for enabling PipeWire socket mount
2. Extended API schema v1 with enable_pipewire option in RuntimeConfigure
3. Implemented mount logic in ContainerCfgBuilder to bind host PipeWire socket into container
4. Enhanced container_builder to resolve XDG runtime directory and mount socket
5. Added unit tests covering runtime config and CLI option propagation
6. Updated merge logic for runtime configs to handle PipeWire setting
7. Integrated option flow from CLI, runtime config, and JSON serialization/deserialization

Log: Added --enable-pipewire option to mount PipeWire audio socket inside sandbox for audio support

Influence:

1. Test CLI flag with --enable-pipewire on container run, verify socket is mounted
2. Test runtime config JSON with enable_pipewire: true, verify mount behavior
3. Test mount failure when host socket does not exist or is not a socket
4. Test config merge: partial configs, overwrite order, and default behavior
5. Verify socket accessibility inside container (permissions, path)
6. Test combined with other options like --disable-xdp to confirm no conflicts
7. Test on systems with and without PipeWire installed
8. Verify backward compatibility for existing configs without the new field

[deepin-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: dengbo11

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[dengbo11]

pre-commit.ci autofix

[gemini-code-assist]

Code Review

This pull request introduces support for mounting the PipeWire socket inside the sandbox via a new enable_pipewire configuration option and a corresponding --enable-pipewire CLI flag. This includes updates to the API schemas, CLI arguments, container builder, and OCI configuration generator, along with associated unit tests. Feedback on the changes highlights a critical issue in ContainerCfgBuilder::buildXDGRuntime(), where calling std::filesystem::is_socket without an std::error_code argument inside a noexcept function could throw an exception and crash the application if the path is inaccessible or does not exist.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[codecov]

Codecov Report

❌ Patch coverage is 34.78261% with 15 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
...glong/oci-cfg-generators/container_cfg_builder.cpp	0.00%	7 Missing ⚠️
apps/ll-cli/src/main.cpp	0.00%	4 Missing ⚠️
...inglong/src/linglong/runtime/container_builder.cpp	60.00%	4 Missing ⚠️

Files with missing lines	Coverage Δ
libs/linglong/src/linglong/cli/cli.h	8.33% <ø> (ø)
...inglong/oci-cfg-generators/container_cfg_builder.h	34.14% <ø> (ø)
libs/utils/src/linglong/utils/runtime_config.cpp	38.88% <100.00%> (+0.98%)	⬆️
apps/ll-cli/src/main.cpp	0.00% <0.00%> (ø)
...inglong/src/linglong/runtime/container_builder.cpp	9.16% <60.00%> (+1.40%)	⬆️
...glong/oci-cfg-generators/container_cfg_builder.cpp	11.87% <0.00%> (-0.08%)	⬇️

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[dengbo11]

/gemini review

[gemini-code-assist]

Code Review

This pull request introduces support for mounting the PipeWire socket inside the sandbox via a new "enable_pipewire" configuration option and a corresponding "--enable-pipewire" CLI flag. It updates the schema, API models, container builders, and OCI configuration generators to handle this new option, and includes comprehensive unit tests. The feedback highlights a redundant nested "if (pipewireMountOption)" check in "container_cfg_builder.cpp" that should be simplified.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[deepin-ci-robot]

deepin pr auto review

★ 总体评分：95分

■ 【总体评价】

代码实现了玲珑沙箱容器内PipeWire音频服务Socket的可选挂载功能，逻辑严谨且包含完整单元测试
全链路实现符合现有代码规范，无安全漏洞，仅在Socket路径处理上存在轻微硬编码问题

■ 【详细分析】

• 1.语法逻辑（完全正确）✓

代码在 ContainerCfgBuilder::enablePipewireSocketMount 和 buildXDGRuntime 中正确处理了 PipewireMountOption 的传递与挂载逻辑。RunContainerOptions::applyRuntimeConfig 和 applyCliRunOptions 对 optional 类型的判断与赋值准确无误，CLI参数覆盖逻辑与现有 disableXdp 保持一致。
潜在问题：buildXDGRuntime 中调用 bindIfExist 时直接解引用 containerXDGRuntimeDir，若该变量在特定异常流中未被赋值，可能存在空指针解引用风险，但根据函数上下文该变量应已初始化。
建议：在解引用前增加防御性检查，确保 containerXDGRuntimeDir 具有有效值。

• 2.代码质量（优秀）✓

代码风格与项目现有规范高度一致，命名清晰。API Schema、类型定义、CLI参数、构建器、配置合并及测试用例的修改一气呵成，覆盖了全链路。单元测试涵盖了配置应用、CLI覆盖及配置合并等关键场景。
潜在问题：宿主机Socket名称 pipewire-0 在 container_builder.cpp 和 container_cfg_builder.cpp 中被硬编码，若未来PipeWire协议变更Socket名称，需多处修改。
建议：将Socket名称提取为常量或配置项，减少魔法字符串的使用。

• 3.代码性能（高效）✓

新增逻辑仅涉及简单的路径拼接与条件判断，未引入额外循环或复杂计算，对容器构建性能无负面影响。
潜在问题：无
建议：无需优化。

• 4.代码安全（存在0个安全漏洞）✓

漏洞对比统计：新增漏洞 0 个，减少漏洞 0 个，持平 0 个
该功能将宿主机PipeWire Socket挂载至沙箱内，属于用户显式授权的权限开放，非代码实现缺陷。路径拼接基于固定字符串，不存在路径遍历或注入风险。

• 建议：虽然直接挂载Socket是功能需求，但PipeWire可访问屏幕及音频，建议在文档中明确提示此功能的安全影响。

■ 【改进建议代码示例】

// 文件: libs/oci-cfg-generators/src/linglong/oci-cfg-generators/container_cfg_builder.cpp
// 在 buildXDGRuntime() 中增加防御性检查

    if (pipewireMountOption) {
        if (!containerXDGRuntimeDir.has_value()) {
            return LINGLONG_ERR("container XDG runtime dir is not set");
        }
        bindIfExist(*runMount,
                    pipewireMountOption->hostSocketPath,
                    *containerXDGRuntimeDir / "pipewire-0",
                    false);
    }